logstash on Ubuntu seems to log in three places (I didn't set this up so I'm not positive what isn't default), which has caused one of our nodes to fill / because the ES instance it's writing to has some index issues.
Because anything worth logging once is worth logging three times!
I got to redirect syslog to our central log server (something we've been meaning to do anyway), remove a lot of files from /var/log/logstash, and then vacuum journalctl and tell it to retain only 500MB.
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!